Summary

Adds Anthropic, API, Claude, CLI, DNS, IP, MFA, RBAC, SSO, URL to the SIEM-Names/namecase.yml exceptions list so the namecase check no longer flags rule names that follow the team's established naming convention.

Why this matters

The SIEM-Names.namecase vale rule extends capitalization with match: $sentence, requiring rule names to be in sentence case unless a substring appears in the exceptions list. The current list is heavily phrase-oriented (e.g., Auth0 Guardian MFA, AWS Console login without MFA, Auth0 Suspicious IP Throttling) and lacks generic acronym entries. As a result, scores of production SIEM rules in DataDog/security-monitoring would fail this check if re-validated today — they don't get re-checked because the pre-commit hook only runs on modified files.

Survey of cloud-siem/log-detection/production/ rule names (861 total):

Examples that currently pass CI on prod but would be blocked from any modification until this PR lands:

• "Activity observed from malicious IP"
• "Atlassian administrative API token activity observed"
• "Slack CLI login from suspicious IP address"
• "Azure AD MFA disabled"
• "Gitlab SSO disabled"
• "GitHub IP allow list"

Concrete impact (motivating case)

Authoring the new Anthropic Compliance SIEM rule pack (zmackie/anthropic-compliance-scaffold) hit this wall: 9 of 21 scaffold rules tripped SIEM-Names.namecase for using SSO, API, IP, RBAC, or Claude — the same acronyms that production Slack, Atlassian, GitHub, Azure, and Auth0 packs use without expansion. With these exceptions added, the 9 rule names pass validation unchanged.

Brand nouns

Anthropic and Claude are added alongside the acronyms because the new SaaS audit-log integration ("Claude Compliance") will use both in rule names. This follows the existing convention of registering single-word product brands (Cloudflare, GitHub, Okta, JumpCloud, 1Password, TruffleHog, Tor).

Verification

Local vale run before this change, against the 9 failing Anthropic-Compliance rule names plus 5 production examples that would also fail:

✖ 14 errors, 0 warnings and 0 suggestions

After this change, all 14 pass:

✔ 0 errors, 0 warnings and 0 suggestions

Test plan

• Confirm vale still flags genuinely incorrect sentence case (e.g., a name like "Anthropic Compliance Foo Bar" where Foo and Bar aren't proper nouns)
• Confirm pre-commit rule-validation in DataDog/security-monitoring passes for the Anthropic Compliance scaffold once this lands

🤖 Generated with Claude Code